@ondeinference / onde / commits / da160f9

Expand GresIQ credential env vars for CI and build

- Add GRESIQ_API_KEY_DEV, GRESIQ_API_SECRET_DEV, GRESIQ_API_KEY_PRODUCTION, GRESIQ_API_SECRET_PRODUCTION, and HF_TOKEN to all CI jobs and release workflows. - Update build.rs to watch all GresIQ credential variants. - Refactor pulse client to use per-environment embedded credentials.

keypair34 committed Apr 19, 2026 at 15:38 UTC da160f964769ebf7c6b1275e76c71105fd5a0832

6 files changed +102 -9

.github/workflows/ci.yml

+60

@@ -30,6 +30,12 @@ jobs:

30 clippy:

31 name: Clippy (macOS)

32 runs-on: macos-26

33 + env:

34 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

35 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

36 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

37 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

38 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

39 steps:

40 - uses: actions/checkout@v6

41 - uses: dtolnay/rust-toolchain@stable

@@ -42,6 +48,12 @@ jobs:

48 test:

49 name: Test (macOS)

50 runs-on: macos-26

51 + env:

52 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

53 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

54 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

55 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

56 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

57 steps:

58 - uses: actions/checkout@v6

59 - uses: dtolnay/rust-toolchain@stable

@@ -52,6 +64,12 @@ jobs:

64 check-ios:

65 name: Check (iOS device)

66 runs-on: macos-26

67 + env:

68 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

69 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

70 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

71 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

72 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

73 steps:

74 - uses: actions/checkout@v6

75 - uses: dtolnay/rust-toolchain@stable

@@ -65,6 +83,12 @@ jobs:

83 check-ios-sim:

84 name: Check (iOS simulator)

85 runs-on: macos-26

86 + env:

87 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

88 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

89 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

90 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

91 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

92 steps:

93 - uses: actions/checkout@v6

94 - uses: dtolnay/rust-toolchain@stable

@@ -78,6 +102,12 @@ jobs:

102 check-tvos:

103 name: Check (tvOS device)

104 runs-on: macos-26

105 + env:

106 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

107 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

108 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

109 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

110 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

111 steps:

112 - uses: actions/checkout@v6

113 - uses: dtolnay/rust-toolchain@nightly

@@ -91,6 +121,12 @@ jobs:

121 check-tvos-sim:

122 name: Check (tvOS simulator)

123 runs-on: macos-26

124 + env:

125 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

126 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

127 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

128 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

129 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

130 steps:

131 - uses: actions/checkout@v6

132 - uses: dtolnay/rust-toolchain@nightly

@@ -104,6 +140,12 @@ jobs:

140 check-visionos:

141 name: Check (visionOS device)

142 runs-on: macos-26

143 + env:

144 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

145 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

146 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

147 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

148 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

149 steps:

150 - uses: actions/checkout@v6

151 - uses: dtolnay/rust-toolchain@nightly

@@ -117,6 +159,12 @@ jobs:

159 check-visionos-sim:

160 name: Check (visionOS simulator)

161 runs-on: macos-26

162 + env:

163 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

164 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

165 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

166 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

167 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

168 steps:

169 - uses: actions/checkout@v6

170 - uses: dtolnay/rust-toolchain@nightly

@@ -130,6 +178,12 @@ jobs:

178 check-watchos:

179 name: Check (watchOS device)

180 runs-on: macos-26

181 + env:

182 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

183 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

184 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

185 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

186 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

187 steps:

188 - uses: actions/checkout@v6

189 - uses: dtolnay/rust-toolchain@nightly

@@ -143,6 +197,12 @@ jobs:

197 check-watchos-sim:

198 name: Check (watchOS simulator)

199 runs-on: macos-26

200 + env:

201 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

202 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

203 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

204 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

205 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

206 steps:

207 - uses: actions/checkout@v6

208 - uses: dtolnay/rust-toolchain@nightly

.github/workflows/release-sdk-dart.yml

+12

@@ -18,6 +18,12 @@ jobs:

18 outputs:

19 version: ${{ steps.meta.outputs.version }}

21 + env:

22 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

23 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

24 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

25 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

26 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

27 steps:

28 - name: Checkout

29 uses: actions/checkout@v6

@@ -77,6 +83,12 @@ jobs:

83 runs-on: ubuntu-latest

84 if: startsWith(github.ref, 'refs/tags/')

86 + env:

87 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

88 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

89 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

90 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

91 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

92 steps:

93 - name: Checkout

94 uses: actions/checkout@v6

.github/workflows/release-sdk-npm.yml

+12

@@ -18,6 +18,12 @@ jobs:

18 outputs:

19 version: ${{ steps.meta.outputs.version }}

21 + env:

22 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

23 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

24 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

25 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

26 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

27 steps:

28 - name: Checkout

29 uses: actions/checkout@v6

@@ -73,6 +79,12 @@ jobs:

79 runs-on: ubuntu-latest

80 if: startsWith(github.ref, 'refs/tags/')

82 + env:

83 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

84 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

85 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

86 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

87 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

88 steps:

89 - name: Checkout

90 uses: actions/checkout@v6

.github/workflows/release-sdk-swift.yml

@@ -13,6 +13,13 @@ jobs:

13 build-and-release:

14 runs-on: macos-26

16 + env:

17 + GRESIQ_API_KEY_DEV: ${{ secrets.GRESIQ_API_KEY_DEV }}

18 + GRESIQ_API_SECRET_DEV: ${{ secrets.GRESIQ_API_SECRET_DEV }}

19 + GRESIQ_API_KEY_PRODUCTION: ${{ secrets.GRESIQ_API_KEY_PRODUCTION }}

20 + GRESIQ_API_SECRET_PRODUCTION: ${{ secrets.GRESIQ_API_SECRET_PRODUCTION }}

21 + HF_TOKEN: ${{ secrets.HF_TOKEN }}

22 +

23 steps:

24 - name: Checkout onde

25 uses: actions/checkout@v6

build.rs

+1 -1

@@ -7,7 +7,7 @@ fn main() {

7 let _ = dotenvy::from_filename(

8 std::path::Path::new(&std::env::var("CARGO_MANIFEST_DIR").unwrap()).join(".env"),

9 );

10 - for var in ["GRESIQ_API_KEY", "GRESIQ_API_SECRET", "HF_TOKEN"] {

10 + for var in ["GRESIQ_API_KEY_DEV", "GRESIQ_API_SECRET_DEV", "GRESIQ_API_KEY_PRODUCTION", "GRESIQ_API_SECRET_PRODUCTION", "HF_TOKEN"] {

11 println!("cargo:rerun-if-env-changed={var}");

12 if let Ok(val) = std::env::var(var) {

13 if !val.is_empty() {

src/pulse/client.rs

+10 -8

@@ -2,12 +2,12 @@ use smbcloud_gresiq_sdk::{Environment, GresiqClient, GresiqCredentials};

3 use super::events::{InferenceEvent, ModelLoadedEvent};

5 -/// GresIQ API key embedded at SDK build time.

6 -/// Consumer apps never set this — it's Onde Inference's own credential.

7 -const EMBEDDED_API_KEY: Option<&str> = option_env!("GRESIQ_API_KEY");

8 -

9 -/// GresIQ API secret embedded at SDK build time.

10 -const EMBEDDED_API_SECRET: Option<&str> = option_env!("GRESIQ_API_SECRET");

5 +/// GresIQ credentials embedded at SDK build time — one pair per environment.

6 +/// Consumer apps never set these — they're Onde Inference's own credentials.

7 +const EMBEDDED_API_KEY_DEV: Option<&str> = option_env!("GRESIQ_API_KEY_DEV");

8 +const EMBEDDED_API_SECRET_DEV: Option<&str> = option_env!("GRESIQ_API_SECRET_DEV");

9 +const EMBEDDED_API_KEY_PRODUCTION: Option<&str> = option_env!("GRESIQ_API_KEY_PRODUCTION");

10 +const EMBEDDED_API_SECRET_SECRET_PRODUCTION: Option<&str> = option_env!("GRESIQ_API_SECRET_PRODUCTION");

12 /// Onde telemetry client. Wraps GresiqClient so pulse events land in the

13 /// right GresIQ-managed tables without consumer apps knowing anything about

@@ -34,8 +34,10 @@ impl PulseClient {

34 /// `edge_id` is a stable device identifier (installation UUID).

35 /// Pass an empty string to default to `"onde-unknown"`.

36 pub fn new(environment: Environment, edge_id: String) -> Option<Self> {

37 - let api_key = EMBEDDED_API_KEY?;

38 - let api_secret = EMBEDDED_API_SECRET?;

37 + let (api_key, api_secret) = match environment {

38 + Environment::Dev => (EMBEDDED_API_KEY_DEV?, EMBEDDED_API_SECRET_DEV?),

39 + Environment::Production => (EMBEDDED_API_KEY_PRODUCTION?, EMBEDDED_API_SECRET_SECRET_PRODUCTION?),

40 + };

42 let edge_id = if edge_id.is_empty() {

43 "onde-unknown".to_string()